chromelevator | 2026-05-27_18fb6f804fcac257ba7b44073d2d9312_cobalt-strike_icedid_njrat

General

Target
2026-05-27_18fb6f804fcac257ba7b44073d2d9312_cobalt-strike_icedid_njrat
Size 1.4MB
Sample260527-lkmtxact91
SHA256 4e00f127736ba9facfe43e48e179de6e17166f7512bdaac2ba3320eb7e778937
MD5 18fb6f804fcac257ba7b44073d2d9312
SHA1 f3a0e0fbb4df313f9e8d6cf626d4f63b6ab3cc98
SHA512 056a42ac8ff857195662025d0e23157acfef88a5caa763071e71e8b5c1e15c613ce0c8c5232609ef038884408ec17e8d273edd0d741dca14695e59742d6b6acc
SSDEEP 24576:OVjetQGgBfFJ3Xx7mUehSvB1zkRCqW5IOPfkUrRiT1ymzQqTRRMtFq:6ZpBm5q7oMPfkQs1ymzQqU
TLSH
T19E65121AA7A500F9E167D178C9525A06EA72FC055F71BACB03A84BD70F237E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

hacktool chromelevator

Malware Config

Signatures

Family: ChromElevator
ChromElevator is an open-source post-exploitation tool for stealing user data from Chromium browsers.
hacktool chromelevator

Detects ChromElevator 1 IoCs

resource	yara_rule
sample	family_chromelevator

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-27_18fb6f804fcac257ba7b44073d2d9312_cobalt-strike_icedid_njrat

File Explorer

2026-05-27_18fb6f804fcac257ba7b44073d2d9312_cobalt-strike_icedid_njrat

.exe 1.4MB

2026-05-27_18fb6f804fcac257ba7b44073d2d9312_cobalt-strike_icedid_njrat

IMPHASH d4354d60c6c65068f32883a5867f98ed
SHA256 4e00f127736ba9facfe43e48e179de6e17166f7512bdaac2ba3320eb7e778937
MD5 18fb6f804fcac257ba7b44073d2d9312
SHA1 f3a0e0fbb4df313f9e8d6cf626d4f63b6ab3cc98
SHA512 056a42ac8ff857195662025d0e23157acfef88a5caa763071e71e8b5c1e15c613ce0c8c5232609ef038884408ec17e8d273edd0d741dca14695e59742d6b6acc
SSDEEP 24576:OVjetQGgBfFJ3Xx7mUehSvB1zkRCqW5IOPfkUrRiT1ymzQqTRRMtFq:6ZpBm5q7oMPfkQs1ymzQqU
TLSH
T19E65121AA7A500F9E167D178C9525A06EA72FC055F71BACB03A84BD70F237E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects ChromElevator
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1444608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

kernel32

MultiByteToWideChar FreeEnvironmentStringsW GetEnvironmentStringsW GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle Sleep CloseHandle WideCharToMultiByte SetConsoleOutputCP ExpandEnvironmentStringsW WaitForSingleObject GetLastError GetProcAddress CreateProcessW GetModuleHandleW ReadFile WriteFile CreateNamedPipeW PeekNamedPipe GetCurrentThreadId GetCurrentProcessId GetTickCount ConnectNamedPipe GetCommandLineW GetCommandLineA RtlUnwind InitializeSListHead QueryPerformanceCounter RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer RaiseException RtlPcToFileHeader EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection IsProcessorFeaturePresent HeapAlloc RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess HeapFree GetFileType GetStartupInfoW ExitProcess FreeLibrary GetModuleHandleExW GetProcessHeap IsValidCodePage GetACP GetOEMCP GetCPInfo SetEnvironmentVariableW GetSystemTimeAsFileTime VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx SetFilePointerEx GetStringTypeW SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetModuleFileNameW ReadConsoleW HeapSize HeapReAlloc CreateFileW WriteConsoleW GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetFileInformationByHandleEx LocalFree FormatMessageA GetLocaleInfoEx DecodePointer LCMapStringEx

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-27_18fb6f804fcac257ba7b44073d2d9312_cobalt-strike_icedid_njrat

version

kernel32

generic